NCSC Annual Review 2026
Looking back at the National Cyber Security Centre's tenth year and its key developments and highlights, between 1 September 2025 and 31 August 2026.
Page 24 of 29
The changing nature of operational cyber defence
Cyber security is moving from periodic, human-led activity towards continuous, machine-assisted defence operating at national scale.
This is the direction of travel that is outlined in the government’s Cyber Shield concept: using data, partnerships and AI-enabled capabilities to help understand collective vulnerability and detect and disrupt threats.
For organisations, vulnerability management will no longer be limited to periodic scanning. Vulnerability discovery, prioritisation, remediation and verification will become part of an interconnected pathway. Penetration testing and assurance can also become continuous and more accessible, although they will still need direction and well-engineered safeguards to avoid unintended impact.
Security operations can move beyond presenting alerts to analysts, with agents helping to investigate activity, correlate evidence and recommend, or in some instances, take reversible action. Threat intelligence will become more contextual and timelier as models process larger and more diverse datasets, but provenance and confidence will remain essential.
Even with reimagined AI cyber defence, cyber incidents will be experienced, but response can become faster through machine-supported diagnosis and containment. But it is important to implement this alongside rehearsed playbooks, with reliable/high integrity telemetry and clear authority to act within guardrails. The future of cyber defence will depend on combining human expertise, trusted partnerships and AI-enabled capabilities.